0

I have the following conditions multiple times in my logstash.conf.

Is they some way to remove the duplication ?

if [body][content][totalConsumers] != "null" {
    mutate {
        remove_field => ["[body][content][totalConsumers]"]
    }
}
if [body][content][newConsumers] != "null" {
    mutate {
        remove_field => ["[body][content][newConsumers]"]
    }
}
if [body][content][daysActiveConsumers] != "null" {
    mutate {
        remove_field => ["[body][content][daysActiveConsumers]"]
    }
}
edi9999
  • 19,701
  • 13
  • 88
  • 127

1 Answers1

1

The only way to generically loop through fields in logstash is through the use of the ruby{} filter. This answer should get you started.

Community
  • 1
  • 1
Alain Collins
  • 16,268
  • 2
  • 32
  • 55